Proposal: location-guided couriers (steer toward the recipient's last fix, park on a miss)

Summary

The whitepaper lists "multi-hop courier routing informed by encounter history" as future work (§9). This proposes one shape for it: courier copies steer toward a coarse location for the recipient instead of waiting to bump into them, take course corrections from fresher sightings, and follow a defined miss behavior. The goal is useful offline delivery across a region or the country without adding flood load.

Motivation

• Couriers today are chosen by trust tier and connection (§6.2), and envelopes expire after 24 h. Delivery depends on a courier happening to meet the recipient, so reach is roughly local.
• In a rough store-and-forward model, at 5% adoption NYC→LA takes ~3 days with flights running and ~6 with flights grounded. At 1% it's 2–3 weeks. Even a perfect courier misses the 24 h window for most long routes.
• More flooding doesn't scale. Location gives couriers a direction.

Proposal

1. Encounter records keyed by the daily tag. A peer that verifies the recipient's announce can compute that day's courier tag, since the tag is an HMAC of the static key and the UTC day (§6.2). It records "saw tag T at time t, near coarse geohash G." This is a local observation, never broadcast as a claim.
2. Optional envelope header fields. A coarse target geohash (tens of km), the fix timestamp, and a max age. The sealed contents are unchanged.
3. Direction-aware spraying. When several eligible couriers are available, weight the spray-and-wait budget toward couriers whose recent movement (successive coarse cells seen locally) brings the envelope closer to the target.
4. Course correction. When a carrier meets a peer with a fresher encounter for the envelope's tag, it retargets. Only recipient-signed fixes or the carrier's own verified encounters should move the target. Unsigned "I saw them" hints are a black-hole risk.
5. Miss behavior. Each fix gets an uncertainty radius that grows with age. When the radius outgrows the searchable area, or distance to target stops shrinking over N handoffs:
   • spraying stops and all but one copy drops;
   • the last copy parks with a high-uptime peer near the last fix (room server or gateway-mode device);
   • any carrier that gains connectivity hands off to the Nostr mailbox path (building on gateway mode in v1.6.0 and bridging in v1.7.0).
6. Distance-scaled retention. Allow a longer expiry for far targets (for example up to 72 h or 7 d) within the existing slot quotas.
7. Cleanup and recall. Extend deletion to retained originals after a relayed handover (§6.2 doesn't describe this), and add a sender-signed recall. Only receipts and sender recalls can kill copies, so a forged abort can't erase mail.

Costs and risks

• Location metadata. A coarse geohash on the envelope leaks the region of an otherwise unlinkable daily tag. It should be opt-in, coarse, and maybe limited to mutual favorites.
• Spoofed fixes. They could pull mail into a black hole, which is why points 4 and 7 require signatures.
• Storage and battery. These stay bounded by the current quotas (5 per favorite, 2 per verified stranger, 16 KiB).

Open questions

• How can a courier verify a recipient-signed fix without learning the recipient's long-term identity? This would break tag unlinkability. I think it's the main design question.
• How reliable is movement data under iOS and Android background limits?
• How should this fit with the planned encounter-history routing?

Prior art

• Spray-and-wait (Spyropoulos, Psounis and Raghavendra, 2005)
• Last-encounter routing, EASE/FRESH (Grossglauser and Vetterli, 2003)
• GeOpps, carriers chosen by navigation route (Leontiadis and Mascolo, 2007)

Happy to share the delivery-time model or help prototype in a simulator.

— Edgar (drafted with help from Claude)